topic Re: about Splunk Backend? in Getting Data In

about Splunk Backend?

4Name — Fri, 08 Apr 2016 09:44:51 GMT

Hello,

I have several questions about splunk's backend to which I was unable to find a clear answer :

1) What is Splunk Based on?
It's a NoSQL model but is it based on something existant or is it fully developped by Splunk?

2) Hos does Splunk handles logs' new data?
How does it knows where to stop the crawling? or does it crawls the entire files at every check?

Thanks for your answers!

Re: about Splunk Backend?

ChrisG — Fri, 08 Apr 2016 18:49:59 GMT

Splunk indexing and storage technology is proprietary and is not based on open source packages.

For your second question, Splunk software uses a tailing processor to follow incremental changes to log files. For more information about the indexing process in general, read How indexing works in the Managing Indexers and Clusters of Indexers manual.

Re: about Splunk Backend?

4Name — Mon, 11 Apr 2016 07:33:49 GMT

Thanks a lot ChrisG! 🙂

Re: about Splunk Backend?

ddrillic — Mon, 11 Apr 2016 21:07:11 GMT

The second question is about an interesting subject. http://docs.splunk.com/Documentation/Splunk/6.0.5/Data/Howlogfilerotationishandled is fascinating.